35c3 Alberto's story of hacking, love, death experience and prison Alberto Daniel Hill
1
00:00:00,560 –> 00:00:06,319
so you could also look at the
2
00:00:02,639 –> 00:00:06,319
data privacy regulations that they have
3
00:00:07,759 –> 00:00:11,280
and maybe you have a right to be
4
00:00:09,360 –> 00:00:13,280
forgotten
5
00:00:11,280 –> 00:00:15,040
there are companies that only save their
6
00:00:13,280 –> 00:00:17,760
locks for seven days
7
00:00:15,040 –> 00:00:20,560
maybe you just need to wait
8
00:00:17,760 –> 00:00:22,160
so generally be careful when being a
9
00:00:20,560 –> 00:00:24,320
data traveler
10
00:00:22,160 –> 00:00:27,439
this also plays our friend alberto from
11
00:00:24,320 –> 00:00:29,119
uruguay who
12
00:00:27,439 –> 00:00:30,560
at the afternoon was on his computer
13
00:00:29,119 –> 00:00:31,760
with his girlfriend
14
00:00:30,560 –> 00:00:34,640
and he
15
00:00:31,760 –> 00:00:34,640
was looking at a cloud
16
00:00:35,200 –> 00:00:42,000
and he said oh well health data
17
00:00:38,640 –> 00:00:43,040
have they got an admin oops
18
00:00:42,000 –> 00:00:45,520
oops
19
00:00:43,040 –> 00:00:47,200
you see that was the oops
20
00:00:45,520 –> 00:00:50,239
so he wrote the mail
21
00:00:47,200 –> 00:00:50,239
to serge uruguay
22
00:00:51,440 –> 00:00:54,640
central authority
23
00:00:53,120 –> 00:00:56,800
of the country
24
00:00:54,640 –> 00:01:00,000
this is about health records
25
00:00:56,800 –> 00:01:02,559
and he received a very fast a response
26
00:01:00,000 –> 00:01:05,920
by the director of cert
27
00:01:02,559 –> 00:01:05,920
so they took this very seriously
28
00:01:06,960 –> 00:01:09,920
maybe this wasn’t so dramatic because
29
00:01:08,720 –> 00:01:11,520
the hacker
30
00:01:09,920 –> 00:01:12,479
wasn’t really about to do anything so
31
00:01:11,520 –> 00:01:15,280
this was
32
00:01:12,479 –> 00:01:18,400
maybe not that bad
33
00:01:15,280 –> 00:01:20,320
for him this was over
34
00:01:18,400 –> 00:01:22,320
he had notified cert
35
00:01:20,320 –> 00:01:24,000
they had taken responsibility they will
36
00:01:22,320 –> 00:01:26,320
deal with this
37
00:01:24,000 –> 00:01:28,560
alberta was to carry on with his life as
38
00:01:26,320 –> 00:01:31,119
normal but then after one year he
39
00:01:28,560 –> 00:01:34,079
realized that
40
00:01:31,119 –> 00:01:34,960
well they closed the admin admin but now
41
00:01:34,079 –> 00:01:37,520
they have
42
00:01:34,960 –> 00:01:38,720
unauthenticated file access so maybe
43
00:01:37,520 –> 00:01:40,880
i’ll just
44
00:01:38,720 –> 00:01:42,479
go and sort of notify cert
45
00:01:40,880 –> 00:01:44,880
again
46
00:01:42,479 –> 00:01:47,040
sometime past about
47
00:01:44,880 –> 00:01:50,479
two years of silence
48
00:01:47,040 –> 00:01:50,479
he had already forgotten about this
49
00:01:50,560 –> 00:01:54,479
and then the company that has those
50
00:01:52,720 –> 00:01:58,320
health records
51
00:01:54,479 –> 00:02:01,520
and they get an email from somebody
52
00:01:58,320 –> 00:02:01,520
saying give us bitcoin
53
00:02:05,520 –> 00:02:11,520
and the person blackmailing them said
54
00:02:08,879 –> 00:02:14,080
that they had the health records and if
55
00:02:11,520 –> 00:02:16,480
they wouldn’t transfer 15 bitcoins
56
00:02:14,080 –> 00:02:20,840
in a certain amount of time
57
00:02:16,480 –> 00:02:20,840
they would go to the press
58
00:02:24,080 –> 00:02:29,440
of all people who are hiv positive
59
00:02:28,239 –> 00:02:31,680
i’m not sure the press would have been
60
00:02:29,440 –> 00:02:33,120
interested but the police was certainly
61
00:02:31,680 –> 00:02:35,040
interested
62
00:02:33,120 –> 00:02:37,200
you always need to think about the
63
00:02:35,040 –> 00:02:38,720
police
64
00:02:37,200 –> 00:02:42,239
you can
65
00:02:38,720 –> 00:02:42,239
identify them by these hats
66
00:02:43,040 –> 00:02:46,800
there is a star
67
00:02:44,959 –> 00:02:49,360
at the front of the hat
68
00:02:46,800 –> 00:02:52,160
so just so you don’t forget
69
00:02:49,360 –> 00:02:54,480
so somebody wants bitcoin now
70
00:02:52,160 –> 00:02:55,680
and again for a while nothing happens
71
00:02:54,480 –> 00:02:58,159
and then
72
00:02:55,680 –> 00:03:00,400
alberto’s door is kicked in
73
00:02:58,159 –> 00:03:03,280
his house is searched again brute force
74
00:03:00,400 –> 00:03:03,280
attempt as we know it
75
00:03:03,360 –> 00:03:07,280
and now this happens
76
00:03:05,200 –> 00:03:09,360
the police
77
00:03:07,280 –> 00:03:10,959
can’t believe their eyes
78
00:03:09,360 –> 00:03:14,080
when they enter this apartment because
79
00:03:10,959 –> 00:03:16,840
they find so many interesting things
80
00:03:14,080 –> 00:03:20,400
that they will say at a later press
81
00:03:16,840 –> 00:03:23,040
conference and talk about this and
82
00:03:20,400 –> 00:03:26,080
sort of exhibit all their findings
83
00:03:23,040 –> 00:03:28,000
look like this in the picture
84
00:03:26,080 –> 00:03:30,080
stacks of credit cards
85
00:03:28,000 –> 00:03:34,319
blank credit cards
86
00:03:30,080 –> 00:03:34,319
tend to not make the best impression
87
00:03:35,120 –> 00:03:40,239
this is true for uh the supermarket but
88
00:03:37,920 –> 00:03:42,720
also in your
89
00:03:40,239 –> 00:03:46,280
cupboard when the police comes around
90
00:03:42,720 –> 00:03:46,280
also card readers
91
00:03:50,400 –> 00:03:53,840
so they
92
00:03:51,519 –> 00:03:56,720
set this up very nicely
93
00:03:53,840 –> 00:03:57,920
cards cut readers everything
94
00:03:56,720 –> 00:04:01,360
the question would be if the police
95
00:03:57,920 –> 00:04:03,519
actually thought about upset and maybe
96
00:04:01,360 –> 00:04:06,239
censored the credit card numbers we’re
97
00:04:03,519 –> 00:04:06,239
never gonna know
98
00:04:06,480 –> 00:04:11,200
and of course what you find at any
99
00:04:09,040 –> 00:04:13,040
hackers or criminals house
100
00:04:11,200 –> 00:04:15,040
what do you find of course
101
00:04:13,040 –> 00:04:16,560
the mask of anonymous
102
00:04:15,040 –> 00:04:20,000
anonymous
103
00:04:16,560 –> 00:04:23,040
they find the mask they also exhibit it
104
00:04:20,000 –> 00:04:24,880
we don’t have a mask with us
105
00:04:23,040 –> 00:04:29,240
strategic concerns
106
00:04:24,880 –> 00:04:29,240
and strategic money reserves
107
00:04:37,830 –> 00:04:43,840
[Applause]
108
00:04:42,160 –> 00:04:45,759
and that’s what the
109
00:04:43,840 –> 00:04:47,280
blackmailer wanted
110
00:04:45,759 –> 00:04:49,120
so case closed
111
00:04:47,280 –> 00:04:52,160
one and one bitcoin
112
00:04:49,120 –> 00:04:52,160
added up together
113
00:04:52,710 –> 00:04:54,840
[Music]
114
00:04:54,160 –> 00:04:58,240
so
115
00:04:54,840 –> 00:05:00,320
questionings threats
116
00:04:58,240 –> 00:05:03,039
police incompetence
117
00:05:00,320 –> 00:05:05,120
and what alberto does is
118
00:05:03,039 –> 00:05:06,800
confessing falsely
119
00:05:05,120 –> 00:05:08,800
hoping that
120
00:05:06,800 –> 00:05:11,199
during the following procedures
121
00:05:08,800 –> 00:05:13,280
he would meet competent people but that
122
00:05:11,199 –> 00:05:17,039
hope
123
00:05:13,280 –> 00:05:19,520
was wrong he spends eight months in jail
124
00:05:17,039 –> 00:05:23,880
in prison and he is
125
00:05:19,520 –> 00:05:23,880
left out on bail at the moment
126
00:05:25,039 –> 00:05:31,360
he’s very sure that he didn’t do this
127
00:05:27,840 –> 00:05:33,840
because after responsibly disclosing
128
00:05:31,360 –> 00:05:36,560
information you don’t send
129
00:05:33,840 –> 00:05:36,560
a blackmail
130
00:05:36,639 –> 00:05:41,440
especially
131
00:05:38,880 –> 00:05:43,120
if it says please transfer 15 bitcoins
132
00:05:41,440 –> 00:05:44,479
to the following
133
00:05:43,120 –> 00:05:46,479
account
134
00:05:44,479 –> 00:05:49,120
without actually giving the account or
135
00:05:46,479 –> 00:05:49,120
the wallet number
136
00:05:50,560 –> 00:05:56,479
so as we have took some fun at alberto
137
00:05:53,280 –> 00:05:58,720
we actually contacted him and he had to
138
00:05:56,479 –> 00:06:02,720
say a few things
139
00:05:58,720 –> 00:06:02,720
and we welcome him to our video screen
140
00:06:04,800 –> 00:06:09,280
after spending eight months in prison
141
00:06:07,600 –> 00:06:10,160
i have to tell you that i learned many
142
00:06:09,280 –> 00:06:12,560
things
143
00:06:10,160 –> 00:06:15,360
one of them was that i should know how
144
00:06:12,560 –> 00:06:16,400
to manage the truth
145
00:06:15,360 –> 00:06:17,199
when
146
00:06:16,400 –> 00:06:18,160
who
147
00:06:17,199 –> 00:06:20,720
where
148
00:06:18,160 –> 00:06:24,160
how much information you share are key
149
00:06:20,720 –> 00:06:26,319
elements in order to stay out of trouble
150
00:06:24,160 –> 00:06:27,600
after hearing my story people tell me
151
00:06:26,319 –> 00:06:29,759
that the learning is that they should
152
00:06:27,600 –> 00:06:32,160
not report security incidents
153
00:06:29,759 –> 00:06:33,520
and for me that is sad
154
00:06:32,160 –> 00:06:35,440
report them
155
00:06:33,520 –> 00:06:37,440
i don’t report them anymore because i
156
00:06:35,440 –> 00:06:38,800
was forced to and that is the way that i
157
00:06:37,440 –> 00:06:40,160
manage the truce
158
00:06:38,800 –> 00:06:41,840
in my case
159
00:06:40,160 –> 00:06:43,360
i hope to be there next year and share
160
00:06:41,840 –> 00:06:45,520
with you the outcome of my experience
161
00:06:43,360 –> 00:06:49,420
which is crazy
162
00:06:45,520 –> 00:06:58,639
so guys keep on hugging
163
00:06:49,420 –> 00:07:01,680
[Applause]
164
00:06:58,639 –> 00:07:03,360
so the device that he was holding
165
00:07:01,680 –> 00:07:05,599
on the video that looked like an ism
166
00:07:03,360 –> 00:07:10,400
camera
167
00:07:05,599 –> 00:07:12,800
it’s just a very sad misunderstanding
168
00:07:10,400 –> 00:07:15,680
because the police hadn’t taken it when
169
00:07:12,800 –> 00:07:17,120
they searched his house as well as 30
170
00:07:15,680 –> 00:07:18,479
hard drives
171
00:07:17,120 –> 00:07:20,800
and he doesn’t get those devices back
172
00:07:18,479 –> 00:07:21,759
because the police are saying that this
173
00:07:20,800 –> 00:07:23,840
was
174
00:07:21,759 –> 00:07:25,199
would take way too much time to look at
175
00:07:23,840 –> 00:07:28,080
everything
176
00:07:25,199 –> 00:07:28,080
so what we learn is
177
00:07:28,560 –> 00:07:32,240
it makes kind of makes sense
178
00:07:34,639 –> 00:07:37,840
to keep
179
00:07:35,680 –> 00:07:40,080
127.001
180
00:07:37,840 –> 00:07:40,080
as